Release Notes: Device (minor,major) numbers are checked now. To improve server performance and scalability, client records are stored in an AVL tree now, linking against the gmp library is supported, and some other tweaks have been made. The client/server setup is now explained in more detail in the manual.
Release Notes: An enhanced check for kernel module rootkits (Linux only) to detect 'stealth' syscall redirection, the server can also be compiled to listen for syslog reports from remote hosts, a new ability to write logfiles in XML format, the default install paths comply with the Filesystem Hierarchy Standard, some minor bugs have been fixed, and build support for Mac OS X.
Release Notes: On Linux, samhain can detect loadable kernel module rootkits, and fixes for signed databases in BSD. Problems with repetitive reports by the daemon have been fixed, the installation has been streamlined, init scripts for Linux (SuSE, Redhat, and Debian) have been added, and the docs have been revised.